3 unchanged sentences
In some cases, our clients’ operations depend on our building systems.
−Removed: The risk of a security breach, incident, compromise or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and
−Removed: sophistication of attempted attacks and intrusions from around the world have increased.
+Added: The risk of a security breach, incident, compromise or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased.
Like other businesses, we have been, and expect to continue to be, subject to attempts at unauthorized access of our network, mishandling or misuse, computer viruses or malware, cyber-attacks and intrusions and other events of varying degrees.
−Removed: To date, these events have not, individually or in the aggregate, materially affected our operations or business.
+Added: To date, these events have not, individually or in the aggregate, had a material adverse effect on our operations or business.
In addition, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.
3 unchanged sentences
The primary goal of our cybersecurity program is to prevent cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur.
−Removed: We aim to take an active approach to monitoring and evaluating our cybersecurity threat environment and risk profile as part of our cybersecurity program, which is administered by our information systems (“IS”) department, led by our Senior Vice President, Chief Technology Officer (“CTO”) and Senior Vice President, Chief Information Officer (“CIO,” together with our CTO, “IS Leaders”).
−Removed: Our IS Leaders are primarily responsible for the direction and implementation of technology, applications and security at BXP.
−Removed: Our CTO has extensive technology and program management experience with approximately 40 years of technology experience, 26 years of which have been with BXP and a total of 30 years with publicly-traded REITs.
−Removed: In January 2024, our IS leadership expanded to include our CIO, who has 30 years of technology experience developed across multiple industries, including commercial real estate, in guiding organizations through strategic initiatives that span technology, cybersecurity, and digital transformations.
+Added: We aim to take an active approach to monitoring and evaluating our cybersecurity threat environment and risk profile as part of our cybersecurity program, which is administered by our information systems (“IS”) department and led by our Senior Vice President, Chief Information Officer (“CIO”).
+Added: Our CIO is primarily responsible for the direction and implementation of technology, applications and security at BXP and has 30 years of technology experience developed across multiple industries, including commercial real estate, in guiding organizations through strategic initiatives that span technology, cybersecurity, and digital transformations.
We maintain written information security policies and procedures, including a Cybersecurity Incident Response Plan (“CIRP”) for incidents involving potential or actual compromises of information security.
Our CIRP is overseen by the cyber executive response team, which is chaired by our Vice President, Risk Management and includes representatives from our IS and legal departments.
−Removed: In the event of a cybersecurity incident, we have implemented procedures to (i) mobilize third-party subject matter experts and (ii) notify executive leadership and the Audit Committee and/or the full Board of Directors, in each case, as appropriate.
+Added: In the event of a cybersecurity incident, we have established
+Added: procedures to (i) mobilize third-party subject matter experts and (ii) notify executive leadership and the Audit Committee and/or the full Board of Directors, in each case, as appropriate.
As part of our overall cybersecurity program, we also conduct:
6 unchanged sentences
• Regular cybersecurity awareness trainings & simulations .
−Removed: We conduct cybersecurity awareness training for employees and primary on-site providers during onboarding, and thereafter, multiple times per year, and we conduct regular phishing simulations in an effort to raise awareness of spoofed or manipulated electronic communications and other security threats, as well as annual tabletop simulations.
+Added: We conduct cybersecurity awareness training for employees and primary on-site providers during onboarding and at least annually thereafter.
+Added: In addition to annual trainings, we conduct regular phishing simulations in an effort to raise awareness of spoofed or manipulated electronic communications and other security threats, as well as annual tabletop simulations.
In addition, our internal audit function integrates the assessment and identification of cybersecurity-related risks into our annual overall enterprise risk assessment (“ERA”).
3 unchanged sentences
These third-party service providers also face cybersecurity threats, and a cybersecurity incident impacting any of our third-party service providers could also indirectly affect our operations, performance and results of operations.
−Removed: We have a data security committee,
−Removed: consisting of members from various BXP departments, including IS, legal and risk management, that meets periodically to assess, identify and manage cybersecurity risks related to certain third-party service providers and to protect our critical financial and sensitive business information, as well as personally identifiable information (collectively, “Sensitive Information”).
+Added: To date, none of our third-party service providers’ cybersecurity incidents have been, individually or in the aggregate, material to us.
+Added: We have a data security committee, consisting of members from various BXP departments, including IS, legal and risk management, that meets periodically to assess, identify and manage cybersecurity risks related to certain third-party service providers and to protect our critical financial and sensitive business information, as well as personally identifiable information (collectively, “Sensitive Information”).
The data security committee has implemented processes for evaluating the risk profile of those service providers that handle or have access to Sensitive Information, which informs applicable contractual obligations with these service providers.
1 unchanged sentence
Cybersecurity Governance
−Removed: Our Board of Directors is primarily responsible for risk oversight and discharges its responsibility directly or indirectly through its committees.
+Added: Our Board of Directors is primarily responsible for risk oversight and discharges its responsibility directly and indirectly through its committees.
In general, our risk management is designed to be facilitated through a top-down and bottom-up communication structure whereby the Board and/or its committees provide oversight and direction, and management is charged with the day-to-day management of risks, regular assessment of the risk environment and regular reporting to the Board, which may include management reports and reports from outside advisors and consultants engaged by the Board, a specific committee or management, as appropriate.
This overall risk management and oversight framework includes risks related to cybersecurity threats.
−Removed: Pursuant to its charter, the Audit Committee oversees senior management’s risk management processes related to assessing, identifying and managing cybersecurity risks in an effort to, among other things, help align our risk exposure with our strategic objectives.
−Removed: The Audit Committee meets no less frequently than annually with our IS department to discuss, among other things, recent trends in cyber risks, cybersecurity incidents, if any, and our cybersecurity defense strategy to protect against cyber-attacks and intrusions.
−Removed: These discussions with the Audit Committee are led by our IS Leaders and senior management.
+Added: Pursuant to its charter, the Audit Committee oversees management’s risk management processes related to assessing, identifying and managing cybersecurity risks in an effort to, among other things, help align our risk exposure with our strategic objectives.
+Added: Our CIO meets with our Audit Committee at least two times each year to discuss, among other things, recent trends in cyber risks, cybersecurity incidents, if any, and our cybersecurity defense strategy to protect against cyber-attacks and intrusions.
+Added: These discussions with the Audit Committee are led by our CIO and senior management.
The Audit Committee provides regular updates to the full Board of Directors on matters under its purview, including risk management and cybersecurity matters.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.